CVE-2011-0063: MJ2 Majordomo 2

Medium severity, CVSS 5.0. EPSS: 85.5% chance of exploitation in the next 30 days.

The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the "extra" parameter to the help command, which causes the regular expression to produce .. (dot dot) sequences. NOTE: this vulnerability is due to an incomplete fix for CVE-2011-0049.

Affected products

• MJ2 Majordomo 2: up to and including 20110203; version 20110101 only; version 20110102 only; version 20110103 only; version 20110104 only; version 20110105 only; …

Published 2011-03-15. Last modified 2026-06-16.